The invention disclosed herein relates generally to a system and method for performing a snapshot and for restoring data. More particularly, the present invention relates to a system and method for performing snapshots of an information store, which are stored across multiple storage devices, and for restoring partial or full snapshots.
To obtain a more thorough understanding of the present invention, the following discussion provides additional understanding regarding the manner is which magnetic media is used to store information. Using traditional techniques, copies of an information store are performed using the operating system's file system. Copying is done by accessing the operating system's (OS) file system for the information store to be backed-up, such as the Windows NTFS file system. The file allocation system of the operating system typically uses a file allocation table to keep track of the physical or logical clusters across which each file in the information store is stored. Also called an allocation unit, a cluster is a given number of disk sectors that are treated as a unit, each disk sector storing a number of bytes of data. This unit, the cluster, is the smallest unit of storage the operating system can manage. For example, on a computer running Microsoft's Windows 95 operating system, the OS uses the Windows F AT32 32-bit file allocation table having a cluster size to 4K. The number of sectors is determined when the disk is formatted by a formatting program, generally, but not necessarily, when the OS is installed.
The operating system allocates disk space for a file only when needed. That is, the data space is not preallocated but allocated dynamically. The space is allocated one cluster at a time, where a cluster is a given number of consecutive disk sectors. The clusters for a file are chained together, and kept track of, by entries in a file allocation table (FAT).
The clusters are arranged on the disk to minimize the disk head movement. For example, all of the space on a track is allocated before moving on to the next track. This is accomplished by using the sequential sectors on the lowest-numbered cylinder of the lowest numbered platter, then all sectors in the cylinder on the next platter, and so on, until all sectors on all platters of the cylinder are used. This is performed sequentially across the entire disk, for example, the next sector to be used will be sector 1 on platter 0 of the next cylinder.
For a hard (fixed) disk, FAT, sector, cluster, etc. size is determined when a disk formatting program formats the disk, and are based on the size of the partition. To locate all of the data that is associated with a particular file stored on a hard disk, the starting cluster of the file is obtained from the directory entry, then the FAT is referenced to locate the next cluster associated with the file. Essentially, the FAT is a linked list of pointers to clusters on the disk, e.g., each 16-bit FAT entry for a file points to the next sequential cluster used for that file. The last entry for a file in the FAT has a number indicating that no more clusters follow. This number can be from FFF8 to FFFF (base 16) inclusive.
FIG. 1 shows an example directory entry 2 of a Windows-formatted hard disk and accompanying FAT 20. The exemplary directory entry 2 consists of 32 bytes of data. The name of the file and its extension are stored in the first eleven bytes 4 of the directory entry 2 and a file attribute byte 6 is provided. By definition, ten bytes 8 are reserved for future use and four bytes are provided to store time 10 and date 12 information (two bytes each). Two cluster bytes 14 point to the first cluster of sectors used to store the file information. The last four bytes 18 of the directory entry 2 are used to store the size of the file.
A sixteen-byte section of a FAT 20 is depicted. The first four bytes 21 store system information. A two-byte pair, bytes four and five (16), are the beginning bytes of the FAT 20 used to track file information. The first cluster for data space on all disks is cluster “02.” Therefore, bytes four and five (16) are associated with the first cluster of disk sectors “02” used to store file information. Bytes six and seven (22) are associated with cluster “03” . . . and bytes fourteen and fifteen (24) are associated with cluster “07.”
This example illustrates how sectors associated with a file referenced in a directory are located. The cluster information bytes 14 in the directory 2 point to cluster number “02.” The sectors in cluster “02” (not shown), contain the initial sector of data for the referenced file. Next, the FAT is referenced to see if additional clusters are used to store the file information. FAT bytes four and five (16) were pointed to by the cluster information bytes 14, and the information stored in bytes four and five (16) in the FAT 20 point to the next cluster used for the file. Here, the next cluster is “OS”. Accordingly, cluster “OS” contains the next sector of data for the referenced file. FAT bytes ten and eleven (26) contain an end-of-file flag, “FFFF,” indicating there are no more clusters associated with the referenced file. All of the information comprising the referenced file, therefore, is contained in clusters “02” and “05” on the disk.
As with other applications running on the computer, a typical backup application provides a read request to the operating system, which handles interpretation of the information contained in the FAT and reading of each file for the backup application. A file system is provided on the storage device that is used by the backup application to write files that are copied to the device. Similarly, the recovery portion of the backup application, or a separate recovery application, may read files from the storage device for recovery of the information.
Inherent problems and disadvantages have been discovered with currently available systems and methods for archiving data contained in an information store. One technique is to perform a full copy of the data contained in the information store. Utilizing this technique results in two separate copies of the information store, and the length of time it takes to make this kind of copy is related to the amount of data copied and the speed of the disk subsystem. For example, assuming a transfer rate of 25 MB/sec, the approach will take one hour to copy 90 GB of data. These techniques, however, in addition to other disadvantages, require the applications on the information store to be quiesced during the copy routine. This places a significant burden on system administrators to complete copying and get critical systems back into the production environment as, absent a high-speed data bus, the copying may consume a significant amount of time to complete.
Administrators typically keep multiple copies of a given information store. Unfortunately, this has the drawback of requiring n times the amount of space of the information store to maintain n copies, which can be quite expensive to store, in addition to requiring complex and time consuming techniques for restoration of the copied data.
One currently available alternative is to perform snapshots of an information store. With current snapshot systems and methods, administrators create an incremental copy that is an exact point-in-time replica of the source volume each time a snapshot is taken. A series of snapshot are stored locally on the information store from which it was taken and track incremental changes to the data in the information store. Furthermore, changed data is written to a new location in the information store as tracked by the snapshot. With knowledge regarding the change, as well as the changed data, the snapshot can be used to “roll back” changes to an information store to the point in time when the snapshot was taken. If there should be any logical corruption in the information store's data that went undetected for a period of time, however, these incremental updates faithfully replicate that logical corruption to the data when copying. Additionally, other drawbacks are associated with currently know snapshot techniques, including the significant drawback of preventing restoration from the snapshot in the event that the information store fails, as both the snapshot and the information store become unavailable.
Systems and methods are needed, therefore, that overcome problems associated with currently known techniques for taking, maintaining and restoring snapshots.